Direct answer

RCON is remote console access, not a normal player connection; anyone with the credential can execute powerful server commands.

Recommended procedure

  1. Leave RCON disabled unless you need it. If enabled, generate a unique strong rcon.password and confirm the configured TCP port.
  2. Restrict access with a firewall, VPN or localhost-only tunnel; never publish the RCON port to the internet solely for convenience.
  3. Rotate credentials if they appear in chat, logs or a public repository, and audit which automation jobs use the remote console.

Why this matters

Treat console access, operator status, remote-control credentials, and proxy secrets as privileged access. Limit them to people and systems that actually need them.

Important limitation: RCON is not encrypted by default in the vanilla protocol; do not rely on the password alone to protect commands over untrusted networks.

How to verify the result

  • Test a connection from the intended management host and verify an external untrusted host cannot access the RCON port.

Version and compatibility notes

  • When a setting, command, or file name differs from this guide, stop and check the documentation for your exact Minecraft/server-software version instead of forcing an old example.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000